How to Use CISA’s Known Exploited Vulnerabilities List to Patch What Matters

Every week brings another wave of security alerts. There's a "critical" bug in something you use, a CVSS score of 9.8 somewhere else, and a vendor email marked URGENT. If you manage servers, client websites or a small company's IT, it's easy to feel like you're supposed to patch everything, immediately, all the time. Nobody can do that, and that's where a list of known exploited vulnerabilities becomes your best friend.

The question I keep coming back to is simpler: which of these are attackers actually using right now? That's exactly what CISA's Known Exploited Vulnerabilities catalog answers. This week it gave a perfect example of why it matters. On October 23, CISA added two critical flaws, one in Collabora Online for Nextcloud and one in Arista's VeloCloud Orchestrator, because real attackers were already using both.

In this post I'll explain what the Known Exploited Vulnerabilities catalog is, why it's a better starting point than severity scores alone, what these two new entries teach us, and how even a one-person team can turn the list into a simple weekly habit using a short Python script.

What is the Known Exploited Vulnerabilities catalog?

The Known Exploited Vulnerabilities (KEV) catalog is a public list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA). A vulnerability is added only when three things are true:

1. It has an official CVE ID.
2. There is reliable evidence it's being exploited in real attacks.
3. There is clear guidance on how to fix or mitigate it.

That last point is underrated. Every entry on the list is something you can actually do something about.

For US federal civilian agencies, a KEV listing comes with a hard deadline. Under CISA's Binding Operational Directive 26-04, they must prioritise these fixes, especially on internet-facing systems where an attack would give full control. For the two flaws added this week, that deadline is October 26, 2026. The directive also expects agencies to check whether attackers got in before the patch went on.

The rest of us aren't bound by that directive, but CISA openly encourages every organisation to use the same approach. It costs nothing, and it may be the most useful free security resource there is.

Why isn't a CVSS score enough?

Most of us were taught to sort vulnerabilities by their CVSS score: 9.0 and above is critical, so fix those first. The score is useful, but it answers a different question. CVSS measures how bad a bug could be if someone exploited it. It doesn't tell you whether anyone is actually doing that.

Thousands of new CVEs are published every year, and many of them score high. Only a small fraction ever get exploited in the wild. If you treat every 9.x as an emergency, you burn out on bugs nobody is attacking, while the one actively hitting your industry waits in the queue.

I find it helpful to think of it like this:

• CVSS tells you how dangerous the weapon is.
• The Known Exploited Vulnerabilities list tells you someone is already firing it.

Both matter, but the second one should decide what you fix today. For everything that isn't on the KEV list yet, a second free signal is FIRST's EPSS score. It estimates how likely a bug is to be exploited soon, which helps you sort the rest of the queue.

This week's two additions, explained simply

Here's what CISA added on October 23, in plain language. If you want the full technical breakdown, I've written a detailed guide on ByteMuni: CISA KEV alert: Collabora Online and Arista VeloCloud flaws under active attack.

1. Collabora Online's built-in server for Nextcloud (CVE-2026-110447, CVSS 9.2)

Plenty of small companies, schools and agencies run Nextcloud as their own private Google Drive. To edit documents in the browser, many install an add-on called Collabora Online - Built-in CODE Server (richdocumentscode).

A script inside that add-on put part of the web address it received into a system command. When the document server wasn't running, for example during a restart, an attacker could hide their own command in the URL and the server would run it.

Admins who were hit reported that attackers:

• planted a tiny PHP "web shell," a backdoor that runs whatever command is sent to it
• sent the server's details to an outside website to confirm it worked
• searched for KeePass password databases, Bitwarden and 1Password files, and Bitcoin, Monero and Ethereum wallets

The fix: update the app to 26.4.303 or later, or remove it. Simply disabling it doesn't close the hole.

2. Arista VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9)

VeloCloud is SD-WAN software that links a company's offices, data centres and cloud services into one network. The Orchestrator is the control panel for all of it.

The bug is an SQL injection. Anyone with a valid login, even the weakest "read-only" account, can promote themselves to a top-level operator. In a lot of deployments, read-only accounts belong to partners, contractors or managed service providers, so one stolen password can be enough.

The fix: on-premises customers should upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later. Arista says its hosted orchestrators are already patched.

What can we learn from these two flaws?

When I look at these entries together, three lessons stand out. They apply far beyond Nextcloud and VeloCloud.

Lesson 1: The "extra" software is often the weak spot

Neither bug is in the main product people think about. One is in an optional add-on for editing documents, and the other is in a management console. These pieces are often installed once during setup and then forgotten, yet they frequently run with wide access. If your inventory only lists "Nextcloud" and not every app installed inside it, you'll miss exactly this kind of risk.

Lesson 2: A fix can exist long before anyone calls it urgent

The Collabora fix was released on September 11, but its release notes didn't mention security. Attacks had started on September 10. A forum warning appeared on October 3, and the official advisory followed on October 14. If you only updated when you read "critical security fix," you were exposed for over a month. Keeping software reasonably current, even without a scary headline, closes gaps like this.

VeloCloud shows a different version of the same problem. This is the third exploited Orchestrator flaw since July, and systems patched for the July and September bugs are still vulnerable to this one. "We patched last month" isn't the same as "we're safe now."

Lesson 3: Patching doesn't kick anyone out

An update closes the door. It doesn't remove someone who already walked through it. A web shell planted in September is still sitting there after you install October's fix. That's why CISA's directive expects agencies to look for signs of compromise, and why you should too. Check for unfamiliar files, new accounts, odd outbound connections and suspicious log entries, and if something turns up, change the passwords and keys that machine could see.

How can a small team use the Known Exploited Vulnerabilities list?

You don't need a big security team or an expensive scanner. Here's a simple routine I'd recommend to any freelancer, small agency or IT team of one.

Step 1: Write down what you actually run

Make a plain list of the software and devices you're responsible for: vendor and product names, and versions if you can. Include the boring stuff: Nextcloud apps, WordPress plugins, VPN appliances, routers, NAS boxes, admin panels. A spreadsheet is fine to start with. This list is the foundation of everything else.

Step 2: Get the KEV data

CISA publishes the whole catalog for free as a web page, a CSV file and a JSON feed. Each entry includes the CVE ID, vendor, product, a short description, the required action, the federal due date, and whether the bug is known to be used in ransomware campaigns.

Step 3: Match it against your list automatically

Here's a small Python script that downloads the catalog and shows any entries matching vendors or products you care about, added in the last 30 days. Edit the WATCHLIST to match your own inventory:

import json
import urllib.request
from datetime import date, timedelta

KEV_URL = ("https://www.cisa.gov/sites/default/files/feeds/"
           "known_exploited_vulnerabilities.json")

# Words that describe what YOU run (vendor or product names)
WATCHLIST = ["nextcloud", "collabora", "velocloud", "arista",
             "wordpress", "fortinet", "microsoft", "php"]

DAYS_BACK = 30

with urllib.request.urlopen(KEV_URL, timeout=30) as resp:
    catalog = json.load(resp)

since = date.today() - timedelta(days=DAYS_BACK)

for v in catalog["vulnerabilities"]:
    added = date.fromisoformat(v["dateAdded"])
    text = f'{v["vendorProject"]} {v["product"]}'.lower()
    if added >= since and any(w in text for w in WATCHLIST):
        print(f'{v["cveID"]}  added {v["dateAdded"]}  due {v["dueDate"]}')
        print(f'  {v["vendorProject"]} {v["product"]}: {v["vulnerabilityName"]}')
        print(f'  Ransomware use: {v["knownRansomwareCampaignUse"]}')
        print(f'  Action: {v["requiredAction"]}\n')

Run it once a week, or schedule it with cron or Task Scheduler and have it email you the output. It's a few lines of code, but it turns a list of 1,000+ entries into the handful that actually concern you.

Step 4: Treat a match as a deadline, not a suggestion

When something on your list shows up, give it a real deadline. CISA's federal dates are a good benchmark; this week's is just three days after the listing. Patch internet-facing systems first, especially anything where a successful attack means full control.

Step 5: Check for compromise, then write it down

After patching, spend a few minutes looking for signs someone got in first. Note what you found and what you did. Even a short log is invaluable if a client asks questions later, or if the same product shows up on the list again. For VeloCloud, it already has three times this year.

Step 6: Subscribe so you hear about it first

CISA offers email alerts and an RSS feed for new KEV additions. Subscribe, and filter for your vendors if your email client allows it. You'll often hear about exploited bugs before your vendors email you.

A quick checklist for this week

If you run either of this week's affected products, here's what to do right now:

• Nextcloud: check whether richdocumentscode is installed. Update it to 26.4.303 or later, or remove it (not just disable it). Nextcloud 29 and older can't install the fix, so upgrade Nextcloud or remove the app.
• Nextcloud: search for unfamiliar PHP files such as shx*.php in the app folder, and check web logs since September 10 for odd requests to proxy.php.
• VeloCloud on-premises: upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 or later.
• VeloCloud: limit the Orchestrator's web interface to trusted networks, review who has read-only accounts, and block the attacker IPs Arista shared (74.82.197[.]86 and 38.54.50[.]151).
• Everyone: save your logs before cleaning anything up, and rotate any passwords or keys an affected server could access.

Final thoughts

Security advice often makes it sound like you have to do everything at once. In practice, good security for small teams is mostly about choosing well: knowing what you run, knowing what attackers are actually using, and acting quickly where the two overlap.

The Known Exploited Vulnerabilities catalog makes that choice much easier. It's free, it's maintained by people whose job is tracking real attacks, and it's small enough to check every week. This week's Collabora and VeloCloud entries are a reminder that the list isn't theoretical: those were real servers with real backdoors, and real credentials were at stake.

If you take one thing from this post, let it be this: start your inventory list today, even if it's rough, and check it against the KEV catalog once a week. It's one of the highest-value hours you can spend on security.

References: ByteMuni: CISA KEV alert, Collabora and VeloCloud · CISA Known Exploited Vulnerabilities catalog · CISA alert, October 23, 2026 · The Hacker News · The Hacker News: Nextcloud backdoor attacks · The Hacker News: Arista VeloCloud advisory